#Random
This is a place to discuss all things outside of Splunk, its products, and its use cases.

How do I extract key value from below Json Sample.

vreddy22
New Member

Hi All, I have a sample json event in Splunk as below.  Please help me to understand how I can parse custom_tags value from below . This may have multiple key value pairs in it

{

account:xyz,

eventdate:01/25/2024,

properties: {

            version:1.0,

             requestID: cvv,

              response: {"statusCode":"200", "result":"{\"run_id\":465253,\"custom_tags\":{\"jobname\":\"xyz\",\"domain\":\"bgg\"}}}

              time:12:55

}

}

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use spath for json data

| spath input=properties
| spath input=response.result custom_tags
| spath input=custom_tags
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...